From 685a267d37b5a13ed357d6c03953096d6b88907b Mon Sep 17 00:00:00 2001 From: Lars Knoll Date: Mon, 16 Apr 2018 10:51:29 +0200 Subject: Fix crashes when parsing destructuring expressions x = [y] = z would crash because [y] is a literal and not a valid lvalue in ES5, something our parser didn't catch correctly. Change-Id: I0d7abd9b3f812f1de61c77dccfab5d1778dac793 Reviewed-by: Simon Hausmann --- src/qml/compiler/qv4codegen.cpp | 3 ++- src/qml/compiler/qv4codegen_p.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/qml/compiler/qv4codegen.cpp b/src/qml/compiler/qv4codegen.cpp index a262908960..8ada1d505e 100644 --- a/src/qml/compiler/qv4codegen.cpp +++ b/src/qml/compiler/qv4codegen.cpp @@ -784,9 +784,10 @@ bool Codegen::visit(BinaryExpression *ast) left = left.asLValue(); if (throwSyntaxErrorOnEvalOrArgumentsInStrictMode(left, ast->left->lastSourceLocation())) return false; - expression(ast->right).loadInAccumulator(); + Reference r = expression(ast->right); if (hasError) return false; + r.loadInAccumulator(); if (_expr.accept(nx)) _expr.setResult(left.storeConsumeAccumulator()); else diff --git a/src/qml/compiler/qv4codegen_p.h b/src/qml/compiler/qv4codegen_p.h index a46d47cb67..d51dc29517 100644 --- a/src/qml/compiler/qv4codegen_p.h +++ b/src/qml/compiler/qv4codegen_p.h @@ -188,7 +188,7 @@ public: Const } type = Invalid; - bool isLValue() const { return !isReadonly; } + bool isLValue() const { return !isReadonly && type > Accumulator; } Reference(Codegen *cg, Type type = Invalid) : type(type), codegen(cg) {} Reference() {} -- cgit v1.2.3